Windows' Mysterious 'File Tunneling' Feature Revealed

Windows has a feature called File System Tunnelling that can cause brand-new files to inherit metadata from deleted files. This means that if you delete a file and then quickly create another one with the same name, the new file may show an old creation date.

This happens because Windows caches file metadata for a short period of time after a file is deleted or renamed. When a new file is created with the same name in the same directory within this cache window, Windows applies the cached metadata to the new file.

Microsoft engineer Raymond Chen explained that File System Tunnelling was designed to support the 'safe save pattern' used by applications and to maintain compatibility with older programs that only understood 8.3 short filenames.